line 64 of popthelp.c is
char format[10];
....
line 97 of popthelp.c is then
sprintf(format, "%%.%ds\n%%%ds", (int) (ch - help), indentLength);
which is the culprit, the content for "format" at the time of crash is
(gdb) print format
$2 = "%.24s\n%49 "
and is longer than 10 characters already (terminating zero), so this is actually
overflowing a static buffer on the stack (and the sprintf might well not be
finished yet)